Last updated: October 2026
This policy explains how Project Pixel Studio Ltd ("we", "us") collects and uses personal data when you visit our website, submit a brief, buy a package, or use the client portal. We are the data controller under the UK GDPR and (where applicable) the EU GDPR. We provide services to clients worldwide.
What we collect
- Enquiry details you submit through the Start a project form: your name, email address, and optionally your business or website, the type of service you are interested in, what you would like to improve, and a budget if you choose to give one. These are stored securely in our website database, which only Project Pixel administrators can access, and are sent by email to cameron@project-pixel.com so Cameron can reply. You also receive an automatic confirmation email. We use these details only to respond to and discuss your enquiry.
- For existing clients: details shared during a project, and any files uploaded to their private project area.
- Payment metadata handled by Stripe (we do not see or store card numbers).
- Website usage - Plausible (always on, no cookies, no personal data). Google Analytics 4 and Microsoft Clarity only if you accept analytics cookies.
- Basic technical logs (IP address, user agent) for security.
Why we use it (legal basis)
- Contract - to deliver the services you buy, run your project, invoice you, and provide support.
- Legitimate interests - to secure the site, prevent fraud, and improve our services.
- Consent - analytics cookies and marketing communications (you can withdraw consent at any time).
- Legal obligation - accounting, tax, and compliance records.
Sub-processors
We use trusted third parties, each bound by a data-processing agreement:
- Supabase / Lovable Cloud - hosting, database, authentication, file storage.
- Stripe - payment processing (PCI-DSS Level 1).
- Resend / Lovable Email - transactional email.
- Cloudflare - CDN, DDoS protection, DNS.
- Google Analytics, Microsoft Clarity, Plausible - analytics (see the cookies policy).
International transfers
Some sub-processors are outside the UK/EEA. Where required, we rely on the UK International Data Transfer Addendum, EU Standard Contractual Clauses, or adequacy decisions.
Retention
We keep account data while your account is active; project files for up to 24 months after completion; invoices and tax records for 7 years; analytics data for 14 months (GA4 default). Marketing emails until you unsubscribe.
Your rights
Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to processing of your personal data, and to withdraw consent. UK/EU visitors can complain to the ICO (ico.org.uk) or their local supervisory authority. California residents have additional rights under the CCPA/CPRA. Email cameron@project-pixel.com to exercise any of these - we respond within 30 days.
Security
Data is encrypted in transit (TLS) and at rest. Access is restricted, logged and reviewed. We do not sell personal data and we never will.